Include custom certificate authority (CA) in Agent installation

Include a custom Certificate Authority (CA) in your Agent installation using the Helm values customCa.*. Use this when:

• Your cluster's outbound traffic passes through a Transport Layer Security (TLS)-inspecting proxy.
• You rely on a private Public Key Infrastructure (PKI).
• You use self-signed certificates.

In these cases, the Entitle Agent needs to trust your enterprise CA in addition to the standard public CAs.

Prerequisites

• Helm chart version 2.11.0 or later.
• Agent image version 2.9.10 or later.

To confirm Helm chart and Agent versions see Verify Entitle Agent versions.

Build the combined CA

Create a single Privacy-Enhanced Mail (PEM) file containing your standard public CA and your enterprise CA, concatenated together.

The agent replaces its entire trust store with this file. A file that contains only your enterprise CA will break all outbound TLS, including connections to Entitle's own endpoints. Always concatenate your enterprise CA onto the existing public CA, rather than replacing it.

cat /etc/ssl/certs/ca-certificates.crt enterprise-ca.pem > ca-bundle.pe

Create a Secret or ConfigMap

As a Secret:

kubectl create secret generic entitle-custom-ca --from-file=ca-bundle.pem -n entitle

As a ConfigMap:

kubectl create configmap entitle-custom-ca --from-file=ca-bundle.pem -n entitle

Set the Helm values

Set either customCa.secretName or customCa.configMapName , the install fails if both are set.

helm upgrade --install entitle-agent entitle/entitle-agent \
    --set customCa.secretName="entitle-custom-ca" \
    ... \
    -n ${NAMESPACE}

This configuration persists across helm upgrade — you don't need to reapply it after updating the Agent. Rotating the file's content (updating the Secret or ConfigMap) automatically refreshes running pods. To roll back, remove the customCa.* value and run helm upgrade again.

ℹ️

(Legacy) If you are running on an older version of the Helm chart, you can use Environment variable ENTITLE_CUSTOM_CA_CERT_PATH. This method requires Agent image version 2.9.1 or later.

This variable is applied by patching the running deployment directly, not through Helm. Because of this, it does not persist across helm upgrade — the patch is lost on the next upgrade unless you reapply it manually.

Shell

kubectl set env deployment/entitle-agent ENTITLE_CUSTOM_CA_CERT_PATH=<path> -n entitle

Troubleshooting

Troubleshoot CA-related error messages in the Agent logs: